This attack could pose a serious security threat. You should take immediate action to stop any damage or prevent further damage from happening.
This signature detects attempts to exploit a remote code execution vulnerability using the ADODB.Stream ActiveX Object.
Microsoft Internet Explorer is prone to a security weakness that may permit malicious HTML documents to create or overwrite files on a victim file system when interpreted from the Local Zone (or other Security Zones with relaxed security restrictions, such as the Intranet Zone).
This weakness depends on scripting that abuses the ADODB.Stream Object to write an attacker-specified file to the victim file system. In particular, it is possible to read data from an attacker's Web site by calling the Open method on the Microsoft.XMLHTTP Object. This data may then be stored on a target computer when the Write and SaveToFile methods are called on the recipient ADODB.Stream Object. In this manner, an HTML document that is interpreted in the context of a Security Zone with relaxed security restrictions may install a malicious file on the victim file system.
Exploitation of this weakness typically requires other vulnerabilities to redirect the browser into the Local Zone (or other appropriate Security Zone) then reference the malicious content once it has been written to the client file system. Examples of security issues that may be exploited in combination with this weakness are described in BIDs 8577, 9798, 9769, 10473, and 10472. Other attack vectors also exist, such as enticing a user to download an HTML document to their system then opening it with the Web browser. HTML email may also provide an attack vector for this weakness (in combination with other vulnerabilities). Cross-site scripting and HTML injection vulnerabilities in Web applications may also provide a surreptitious attack vector in unsuspecting clients.
This issue was publicized in August 2003 and was previously referenced in BID 8577 "Multiple Microsoft Internet Explorer Script Execution Vulnerabilities" but is now being assigned its own BID. There are numerous exploits and worms in the wild that depend on this issue, in tandem with other known vulnerabilities, to install malicious code on client computers.
PLEASE NOTE: In some instances where the attempt to overwrite the file may be encoded, this signature may fail to match.
- Microsoft Internet Explorer 5.5, 5.5 SP1, 5.5 SP2, 6.0, 6.0 SP1